JP7157258B2 - Fraud Prevention in Aggregated Network Measurements - Google Patents

Description

A client device transmits data over a public network such as the Internet. These communications can be intercepted and/or modified by entities other than the intended recipient. Additionally, entities can forge network identifiers and transmit data that appears to originate from these forged network identifiers. An example of such forgery is a Sybil attack in which an entity creates a network identifier to subvert the reputation system of a peer-to-peer network.

This specification describes techniques related to determining aggregated network measurements in a manner that prevents fraud and protects user privacy.

In general, one innovative aspect of the subject matter described herein provides, from each of a plurality of client devices, a respective group member key and a group identifier for a given conversion as a result of displaying the digital component. receiving a measurement data element comprising: an application running on each client device encrypting the network data based at least on the network data comprising one or more of the impression data or the conversion data for the conversion; generating group keys that define secrets for each group member key, each group member key containing a respective share of the secret; and generating each group member key based on data associated with the application. each client device generates a different group member key containing a different sharing of the secret, using a threshold encryption scheme to at least have a group identifier determining that a threshold number of measurement data elements have been received; and in response to determining that at least the threshold number of measurement data elements having the same group identifier have been received, groups in the received measurement data elements. decrypting the network data using the member key. Using threshold encryption techniques to report aggregated network data prevents fraudulent reporting, e.g., in situations where reported data relates to or includes user data, Protect user privacy. The generation of different group member keys allows the group key to be regenerated when any combination of group member keys summing at least a threshold number of measurement data elements with a group identifier is received. Thus, network data can be decrypted when at least the threshold group member key is received, but cannot be decrypted when less than the threshold group member key is received. Enabling such secret sharing between client devices without collaboration between client devices protects user privacy by eliminating communication between the user's devices and the bandwidth consumed by such communication. It reduces the width and prevents measurement fraud that can occur if a single private key is simply passed to each application. Other implementations of this aspect include corresponding apparatus, systems, and computer programs encoded on computer storage devices and configured to carry out aspects of the method.

Each of these and other implementations can optionally include one or more of the following features. The measurement data element may contain encrypted data representing network data and may contain a group member key. The group member key may represent a portion of the group key and may be used to regenerate the group key only when a sufficient number of group member keys are received for the same impression-conversion pair. Conversion may be to a digital component and may involve completion of a specified user action after the digital component has been presented to the user or selected by the user. Impression data can relate to a particular presentation of a digital component, such that when a user clicks or interacts with a digital component on the landing page of the digital component (e.g., a page linked by the digital component, the application/browser URL or domain of the page that is displayed to the user), one or more identifiers for the digital components, event-level data associated with the impression, an expiration date that specifies when the impression data is removed from the client device, and/or the digital May include a reporting URL or domain to which conversion reports for the component are sent. Impression data may be provided by the digital component, for example, as metadata for the digital component or as anchor tags for the digital component. Conversion data may include data indicating the type of conversion, as some conversions may have multiple types. The type of conversion may specify subsequent actions after the conversion is complete.

Each application may generate and transmit measurement data elements in response to the occurrence of conversions related to impression data. The method may include determining the number of conversions of the digital component based on the number of data elements received including the group identifier.

The method may include generating a group key based on the blindly signed impression data. Using blind-signed impression data to blind-sign network data allows such data to be checked for fraud while protecting user privacy. More generally, the use of blind signing techniques to blind sign network data allows such data to be checked for tampering while protecting user privacy. Some of the data elements containing network data are encrypted by multiple entities, for example by generating a group key based on blind signed impression data and/or to prevent fraud or collusion from multiple entities can be signed blindly.

Blind-signed impression data is blind-signed impression data signed by a first system that determined that the impression was valid and a second system that determined to register the conversion, where the impression data is Blind-signed combined conversion data may be included, including blinded impression data generated by blinding and conversion data signed by a second system. Generating the group key may include generating the group key using a combination of the blind-signed combined conversion data and the network address of the reporting system where the digital component conversion data is reported. can. Using a combination of such blind signed data and threshold encryption techniques prevents fraud and protects user privacy. The blind-signed combined conversion data may be encrypted using the reporting system's public key. Data associated with an application may include a unique identifier for the application. Threshold encryption schemes may include polynomial-based threshold encryption schemes. An application running on each client device generates a polynomial function as a group key based on a seed containing at least impression data, and selecting the same point on the polynomial function to have a value corresponding to the secret. and selecting a second point on the polynomial function that is different from the same point using data associated with the application as the respective group member key. Decrypting the impression data using the group member key in the received measurement data includes generating a polynomial function using the second points and identifying the same points on the generated polynomial function. and Threshold encryption schemes can include either Chinese Remainder Theorem-based schemes, proactive secret sharing, or verifiable secret sharing.

The subject matter described herein can be implemented in particular embodiments to achieve one or more of the following advantages. Threshold encryption techniques, such as the (t,n)-threshold encryption schemes described herein, encrypt network data (e.g., impression and/or conversion data) or portions or derivatives thereof. , which can then be used as a seed for generating group keys that are divided among multiple applications (eg, web browsers or native applications) on multiple client devices that report network data to be measured. This allows applications running on different client devices to each use the same network data without collaboration between applications (or client devices) and the need for a central system to distribute keys to each application. The same group key that encrypts data can be generated. Instead, each application in which network events (e.g. impressions and associated conversions) occur uses network data received e.g. from digital components and/or remote servers to generate a group key that encrypts the network data. can do.

Each application can use different information to generate a group member key, which when combined with a sufficient number of other group member keys regenerates the group key or another representation of the group key. can be used to create For example, each application may use the application's unique identifier to generate group member keys, allowing each application to generate a group member key that is different from each other application without collaboration between the applications. can. This different group member key generation by each application allows the group key to be regenerated when any combination of group member keys totaling at least a threshold 't' number of group member keys is received. can. Thus, network data can be decrypted when at least t group member keys are received, but cannot be decrypted if less than t group member keys are received. By enabling such secret sharing between applications without collaboration between applications, it protects user privacy by eliminating communication between users' devices and reduces the bandwidth consumed by such communication. reduce and prevent measurement fraud that could occur if a single private key were simply passed to each application.

Various features and advantages of the aforementioned subject matter are described below with respect to the drawings. Additional features and advantages are apparent from the subject matter described herein and from the claims.

1 is a block diagram of an environment in which a digital component system distributes digital components; FIG. FIG. 4 is a flow diagram showing an exemplary process for recording signed impression data; FIG. FIG. 4 is a flow diagram showing an exemplary process for recording conversion data; FIG. FIG. 4 is a flow diagram showing an exemplary process for reporting conversion data; FIG. FIG. 4 is a flow diagram showing another example process for reporting conversion data; FIG. FIG. 4 is a flow diagram showing an exemplary process for decoding impression data; FIG. 1 is a block diagram of an exemplary computer system; FIG.

Like reference numbers and designations in the various drawings indicate like elements.

In general, this specification describes cryptographic techniques for preventing fraud in determining aggregated network measurements. For example, the techniques described herein can be used to prevent fraud in determining aggregated impression and conversion metrics for digital components. The encryption techniques described herein may also protect user privacy, for example, by preventing other entities from tracking or aggregating user data received from the user's client device.

FIG. 1 is a block diagram of an environment 100 in which digital component distribution system 150 distributes digital components. Exemplary environment 100 includes a data communication network 105 such as a local area network (LAN), wide area network (WAN), the Internet, mobile networks, or combinations thereof. Network 105 connects client devices 110 , publishers 130 , websites 140 , digital component distribution system 150 , fraud detection system 170 , aggregation system 180 , and reporting system 190 . Exemplary environment 100 may include many different client devices 110 , publishers 130 and websites 140 . In some implementations, environment 100 may also include multiple digital component distribution systems 150 .

A website 140 is one or more resources 145 associated with a domain name and hosted by one or more servers. An exemplary website is a collection of HTML-formatted web pages that can include programming elements such as text, images, multimedia content, and scripts. Each website 140 is maintained by a publisher 130, an entity that controls, manages and/or owns website 140.

Resource 145 is any data that can be provided over network 105 . Resource 145 is identified by a resource address, eg, a universal resource locator (URL), associated with resource 145 . Resources include HTML pages, word processing and Portable Document Format (PDF) documents, images, videos, and feed sources, just to name a few. Resources can include content such as words, phrases, images, and sounds that can include embedded information (such as meta-information in hyperlinks) and/or embedded instructions (such as scripts).

Client device 110 is an electronic device capable of communicating over network 105 . Exemplary client devices 110 include personal computers, mobile communication devices such as smart phones, and other devices capable of sending and receiving data over network 105 .

Client device 110 typically includes an application 112 such as a web browser and/or native application to facilitate sending and receiving data over network 105 . A native application is an application developed for a specific platform or a specific device. Publisher 130 may develop and provide native applications, eg, make them available for download, to client device 110 . In some implementations, client device 110 is a digital media device, eg, a streaming device that plugs into a television or other display to stream video to the television. Digital media devices may also include web browsers and/or other applications that stream video and/or present resources.

The web browser, for example, in response to the user of the client device 110 entering the resource address of the resource 145 into the address bar of the web browser or selecting a link that references the resource address, publishes the website of the publisher 130. A resource 145 can be requested from the web server hosting 140 . Similarly, native applications can request application content from publisher 130's remote servers.

Some resources 145, application pages, or other application content may include digital component slots for presenting digital components on the resource 145 or application page. As used throughout this specification, the phrase "digital component" refers to a discrete unit of digital content or information (e.g., a video clip, audio clip, multimedia clip, image, text, or other piece of content). unit). A digital component may be stored electronically in a physical memory device as a single file or as a collection of files, and may take the form of video, audio, multimedia, image, or text files. , may contain advertising information, such that advertisements are a type of digital component. For example, a digital component can be content intended to supplement the content of a web page or other resource presented by application 112 . More specifically, the digital component may include digital content related to the resource content (eg, the digital component may relate to the same topic as, or a related topic to, the web page content). Thus, the provision of digital components by digital component delivery system 150 can complement and generally enhance web page or application content.

When an application 112 loads a resource 145 (or application content) that includes one or more digital component slots, the application 112 can request digital components for each slot from the digital component distribution system 150 . Digital component distribution system 150 can then request the digital component from digital component provider 160 . Digital component provider 160 is an entity that provides digital components for presenting resource 145 .

In some cases, digital component distribution system 150 may also request digital components from one or more digital component partners 157 . Digital component partner 157 is an entity that selects digital components on behalf of digital component provider 160 in response to digital component requests.

Digital component distribution system 150 may select the digital component for each digital component slot based on various criteria. For example, the digital component distribution system 150 may determine from the digital components received from the digital component provider 160 and/or the digital component partners 157 the relevance to the resource 145 (or application content), the performance of the digital component (e.g. Digital components can be selected based on factors such as speed at which they interact with the component. Digital component distribution system 150 can then provide the selected digital components to client device 110 for presentation with resource 145 or other application content.

When application 112 presents the digital component, application 112 (which may be a browser) may store impression data 114 for presentation of the digital component. Impression data 114 for a particular presentation of a digital component may be obtained from the landing page of the digital component (e.g., a page linked by the digital component), when the user clicks or interacts with the digital component, the application/browser displays that page to the user. display), one or more identifiers for the digital component, event-level data associated with the impression, an expiration date that specifies when the impression data is removed from the client device 110, and/or conversions of the digital component; Can include a reporting URL or domain to which reports will be sent. This data may be provided by the digital component, for example, as metadata for the digital component or as anchor tags for the digital component. As described in more detail below, rather than or in addition to storing the raw impression data for each impression of the digital component, the application 112 uses the impression data blind-signed by the fraud detection system 170. can be stored.

Application 112 may also store conversion data 116 in response to detected conversions. A conversion for a digital component is the completion of a specified user action after the digital component has been presented to the user or selected by the user. Conversion data 116 for a conversion may include data indicating the type of conversion, as some conversions may have multiple types. The type of conversion can specify subsequent actions after the conversion is completed. For example, a conversion could be adding an item to an online shopping cart. In this example, a first type of conversion could be adding an item without checking out (e.g. not completing a purchase) and a second type of conversion could be adding an item with checkout. could be. As described in more detail below, the conversion data for a conversion can be a set of one or more bits that indicate the type of conversion, and the application uses digital component distribution system 150 (or another suitable system) can store conversion data blind signed.

Fraud detection system 170 can evaluate fraud signals received from client device 110 to determine whether an impression or conversion is valid or fraudulent. Bad signals can be application dependent and can vary between implementations. Application 112 (or an operating system on client device 110 ) collects fraud detection signals and digital components are used by application 112 (or an operating system on client device 110 ) to provide fraud detection signals to fraud detection system 170 . system) can be included. In addition to fraud detection signals, application 112 may send impression blinded impression data to fraud detection system 170 . If the fraud detection system 170 determines that the impression is valid, the fraud detection system 170 can sign the blinded impression data and provide the signed blinded impression data to the application 112. Exemplary techniques for generating blinded impression data and signing the blinded impression data are described below.

Aggregation system 180 can generate aggregated network measurements based on data received from client devices 110 . In the following description, techniques for generating and providing measurement data elements are described as being performed by application 112, which may be a web browser or native application. However, in some implementations, the operating system of client device 110 may generate and transmit measurement data elements. In such implementations, web browsers and applications on client device 110 can be configured to report impressions and conversions to the operating system. The operating system may perform each of the operations for reporting impressions and conversions described below as being performed by application 112 .

Application 112 on client device 110 can provide measurement data elements that include encrypted data representing network data to aggregation system 180 . Network data can include impression data and/or conversion data for each conversion. For example, application 112 may generate and send to aggregation system 180 a measurement data element for each conversion whose conversion data is stored on client device 110 . Aggregated network measurements may include the total number of digital component conversions across multiple client devices 110 for each of the one or more digital components.

As described in more detail below, application 112 can use a (t, n) threshold scheme to generate data in measurement data elements. In some implementations, when application 112 detects a conversion or receives conversion data for a conversion, application 112 generates a group key (e.g., a polynomial function ). The application can then represent a portion of the group key and use it to regenerate the group key only when a sufficient number of group member keys have been received for the same impression-conversion pair. A group member key can be generated. In this example, the conversion measurement data element may include a group membership key generated by the application and a tag corresponding to the impression-conversion pair. Each unique impression-conversion pair can have a corresponding unique tag, which the aggregation system 180 can use to aggregate the measurement data elements for each impression-conversion pair. .

In a (t, n) threshold encryption scheme, the aggregation system 180 receives at least t group member keys for the same impression and conversion pair in order to be able to decrypt the impression and conversion data. There is a need. If less than t group member keys are received, the aggregation system 180 cannot decrypt impression and conversion data. As described in more detail below, when at least t measurement data elements for the same impression-conversion pair are received from the client device 110, the aggregation system 180 derives a group key from the at least t group member keys. can determine and obtain impression and conversion data from the group key.

Aggregation system 180 can determine the amount of conversions for an impression-conversion pair based on the number of received measurement data elements that include impression data and conversion data for the impression-conversion pair. For example, after obtaining impression data and conversion data using at least t group member keys, the aggregation system 180 calculates the amount of conversions as the number of group member keys received for impression-conversion pairs. A count can be determined. Aggregation system 180 may report impression data, conversion data, and amount of conversions to reporting system 190, which may be implemented as a reporting domain corresponding to the digital component's reporting URL, which URL is Corresponds to impression and conversion data.

FIG. 2 is a flow diagram illustrating an exemplary process 200 for recording signed impression data. Process 200 may be implemented by client device 110 interacting with website 140, digital component distribution system 150, and fraud detection system 170, for example. The operations of process 200 may also be implemented as instructions stored on a non-transitory computer-readable medium such that execution of the instructions by one or more data processors causes process 200 to be executed by one or more data processors. can be executed.

A client device fetches content (202). An application 112 running on a client device 110 retrieves content from a remote server, such as a web server hosting one or more websites 140 or an application content server hosting content for one or more native applications. can be requested. In this example, application 112 requests resource 145 from website 140 . A user can enter or select a URL that points to a website 140 hosted by a remote server. An application 112, eg, a web browser, can generate a request for a resource 145 identified by a URL and send the request to a remote server. The request may include the URL of resource 145 .

Website 140 returns 204 the content to the client device. The content can be a web page or other resource 145 identified by a URL. Application 112 may render content on the client device's display (206).

Content can include one or more digital component slots. Digital component slots can be filled with digital components received from digital component distribution system 150 . A digital component slot (or resource 145) can include computer readable instructions that can cause an application 112 to generate a request to the digital component delivery system 150 for a digital component.

Client device 110 requests (208) one or more digital components. For example, application 112 may generate requests in response to executing computer-readable instructions for digital component slots or resources 145 . Application 112 can send a request to digital component delivery system 150 .

Digital component delivery system 150 returns (210) one or more digital components to the client device. As noted above, the digital component delivery system 150 determines from the set of digital components the relevance (e.g., this data can be included in the request) to the resource 145 (or application content) to which the digital component is presented; Digital components may be selected based on various criteria, such as digital component performance, and/or other suitable criteria. Digital component distribution system 150 may request digital components (or distribution criteria for digital components) from digital component providers 160 and/or digital component partners 157 for inclusion in a set of digital components. After selecting the digital component, digital component distribution system 150 can transmit the digital component to client device 110 .

Client device 110 renders 212 the digital component received from digital component distribution system 150 . Application 112 can render a digital component within a digital component slot of resource 145 (or application content). Rendering of the digital component is illustrated in FIG. 2, but when it occurs after the content is rendered, the application 112 combines the content and the digital component by, for example, loading a web page containing the digital component into a digital component slot. can be rendered simultaneously.

The client device 110 stores impression data for each digital component presented with the content (214). As noted above, impression data for a particular presentation of a digital component may include the URL or domain of the digital component's landing page (e.g., the page linked by the digital component), one or more identifiers for the digital component, the impression data may include an expiration date that specifies when to remove the digital component from the client device 110, and/or a reporting URL or domain to which conversion reports for the digital component are sent (eg, the reporting URL of the reporting system 190).

In some implementations, application 112 registers with client device 110 (or an operating system as described above) each digital component that is presented with the content. For example, the digital component can be registered with the client device 110 by rendering the digital component. Digital components can include payload (eg, invisible data) and computer-readable instructions. The payload can contain the impression data described above. The computer readable instructions can cause the digital component to register with application 112 . For example, a digital component may include a call to an API exposed to the digital component by application 112 or a conversion engine of application 112 or client device 110 . A call to the API can contain a payload of digital components. Application 112 can store data in a registration table.

Application 112 blinds the impression data for each digital component presented with the content (216). The application 112 can use blinding techniques to blind the digital component impression data. In general, a blinding technique applies a blinding factor to impression data to generate blinded impression data that obscures the actual impression data so that an entity receiving the blinded impression data uses the blinding technique, and Without knowledge of the parameters/keys used to generate the blinded impression data, the actual impression data may not be determined. In some implementations, the application 112 uses the Internet Engineering Task Force (IETF) draft standard protocol, the Verifiable, Forgetting Pseudorandom Function (VOPRF) protocol, to blind digital component impression data. to blind impression data for digital components. Other suitable blind signing techniques can also be used.

Client device 110 or application 112 collects the fraud detection signal (218). As noted above, application 112 may include an API that allows digital components to call application 112 to collect fraud detection signals and provide fraud detection signals to fraud detection system 170 .

Application 112 sends (220) to fraud detection system 170 blinded impression data for each digital component presented with the content and fraud detection signal. For example, the application 112 can send a request to the fraud detection system 170 and for each digital component to determine whether the impression of the digital component is valid or fraudulent. Each request can be specific to a given digital component, or a single request can be sent for all digital components presented with the content.

The request can include blinded impression data and fraud detection signals. Because the impression data is blinded, the fraud detection system 170 cannot access the actual impression data. This prevents the fraud detection system 170 from obtaining, collecting, or tracking user data of the user of the client device 110 who sent the blinded impression data. The fraud detection system 170 can evaluate the fraud detection signal to determine whether the impression of the digital component is valid or fraudulent. Thus, the fraud detection system 170 can determine whether an impression event is valid based on the fraud detection signal, but cannot determine the content of the event or access the plaintext impression data. .

If the fraud detection system 170 determines that the digital component impression is invalid (e.g., fraudulent), the fraud detection system 170 either ignores the request or requests the request with data indicating that the impression is invalid. can respond to If the fraud detection system 170 determines that the digital component impression is valid, the fraud detection system 170 blind signs the digital component impression data (222). The fraud detection system 170 can blind sign the blinded impression data using blind signing techniques. In some implementations, the blind signing technique may be CloudFlare™'s PrivacyPass or the Google Chrome™ browser's trust token, both of which are based on the IETF VOPRF draft standard.

In general, blind signature techniques allow the digital signature of data that has been blinded, e.g., using a secret blind signature key, without knowledge of the actual impression data, so that the resulting blind signature is the original Can be validated against unblinded impression data. In some implementations, the fraud detection system 170 blind-signs the blinded impression data using the VOPRF protocol using the fraud detection system's 170 blind signing key. Fraud detection system 170 may maintain this blind signing key in secret so that other entities cannot access the blind signing key.

Fraud detection system 170 sends the blind-signed impression data to the client device (224). For example, fraud detection system 170 may send blind-signed impression data to client device 110 or application 112 in response to a request initiated by client device 110 or application 112 . Application 112 can verify the signature of the blinded impression data (226), for example, using the VOPRF protocol. Similarly, application 112 may unblind the blind-signed impression data (228). Application 112 may also unblind blind-signed impression data using the VOPRF protocol used to blind-sign the blind-signed impression data. Application 112 records 230 the signed impression data, for example, by storing the signed impression data on client device 110 and registering the impression in a registration table on client device 110 .

FIG. 3 is a flow diagram illustrating an exemplary process 300 for recording conversion data. Process 300 can be implemented, for example, by client device 110 interacting with website 140 and digital component distribution system 150 . The operations of process 300 may also be implemented as instructions stored on a non-transitory computer-readable medium, such that execution of the instructions by one or more data processing devices causes process 300 to occur in one or more data processing devices. can be executed.

The client device 110 fetches content (302). For example, an application 112 (e.g., a web browser or native application) running on client device 110 responds to a user interacting with, e.g., selecting or clicking on, a digital component to a landing page linked by the digital component. can be requested. Application 112 may send a request to a web server hosting website 140 that contains a landing page.

Website 140 returns 304 the content to the client device. The content can be a web page or other resource 145 identified by a URL. Application 112 can render content on the client device's display. The amount and nature of user interaction required for conversion is defined by individual digital component providers based on their needs. When a conversion actually occurs, the landing page or the website that owns the landing page notifies the application (browser) that the conversion has occurred. In other implementations, the conversion may occur at the app store for mobile apps or at the web store for web apps where users download and install promoted apps. This is commonly called a click-to-install conversion. In such cases, the app store or web store may notify the operating system, browser, or application reporting the conversion data that the conversion has occurred. However, in other implementations, the conversion could be a call by the user to the digital component provider. The smartphone's operating system recognizes the phone and can measure conversions (commonly called click-to-call conversions).

Client device 110 fetches or otherwise receives conversion data (306). In some implementations, the content includes conversion pixels. A conversion pixel may contain a URL to a system that determines whether a conversion report should be generated, eg, whether a conversion has occurred and whether to record the conversion. In this example, the system that determines whether a conversion report should be generated is the digital component delivery system 150.

Conversion pixels can cause application 112 to send data to digital component distribution system 150 . For example, a conversion pixel can include computer readable instructions that cause application 112 to determine whether content (eg, a landing page) is registered in a registration table of client device 110 . As noted above, application 112 can record impression data for digital components presented by application 112 in a registration table. Digital component impression data can include the URL or domain of the digital component's landing page. The application 112 can search the registration table for URLs of landing pages presented as content received in response to the user interacting with the digital component. For click-to-install conversions, the landing page URL will be a deep link URL pointing to the app listed in the app store/web store. For click-to-call conversions, the URL encodes the phone number of the digital component provider.

Once the application 112 finds the landing page URL in the registration table, the client device 110 notifies the digital component delivery system 150 (or other system that determines when to trigger conversion reporting) that the landing page URL matches. You may send blind-signed impression data for a digital component that includes a URL to As noted above, blind-signed impression data includes the blinded impression data and a blind signature of the blinded impression data. In some implementations, application 112 may include blind-signed impression data in the message header of the conversion pixel request.

Digital component distribution system 150 determines whether to trigger conversion reporting (308). The digital component delivery system 150 can determine whether to trigger a conversion report based on receipt of blind-signed impression data and user interaction with content, eg, landing pages. For example, a publisher of a digital component that is interacted with by a user can define a conversion event after the digital component has been presented to the client device 110, such as selecting a particular user interface control on a landing page. . Digital component distribution system 150 can interact with the web server (or client device 110) hosting the landing page to determine whether a conversion event has occurred.

If a conversion event occurs, the digital component distribution system 150 may decide to trigger a conversion report for the digital component. If no conversion event is detected, the digital component distribution system 150 may decide not to trigger conversion reporting for the digital component.

If digital component distribution system 150 determines to trigger conversion reporting for a digital component, digital component distribution system 150 combines (i) already blind-signed impression data and (ii) conversion data for conversion. Blindly sign (310). This conversion data may be a set of one or more bits that indicate the type of conversion, eg, subsequent actions after the conversion is completed. For example, one bit can be used to specify whether a user checked out after a conversion event to add an item to the cart occurred. In this example, the value of the bit may be 0 if no checkout occurred, and the value of 1 if checkout occurred. In other implementations, the conversion data can encode the amount of money spent/purchased by the user as part of the conversion.

Digital Component Delivery System 150 uses Digital Component Delivery System 150's secret blind signing key to blindly sign impression data and conversions on behalf of the website/app store/webstore owner where the conversion occurred. Combinations with data can be blind signed. For simplicity, this blind-signed combination of blind-signed impression data and conversion data is referred to as blind-signed combined conversion data. In some implementations, the conversion data is included as hidden bits in the blind signed impression data. For example, blind-signed impression data can be in the form of a set of bits, and conversion data can be specified by hidden bits. Digital component distribution system 150 can blind sign this combination of bits and hidden bits using its secret blind signing key. At this point, the blinded impression data is blind signed twice (e.g., double-signed impression data). The conversion data is blind signed once using the digital component distribution system's 150 blind signing key.

In some implementations, the digital component distribution system 150 blind-signs the blind-signed impression and conversion data using the VOPRF protocol. The digital component distribution system 150 can keep the blind signing key secret so that other entities cannot access the blind signing key. The digital component distribution system 150 blind signing key is different from the fraud detection system 170 blind signing key used to blind sign the blinded impression data.

Digital component distribution system 150 notifies client device 110 of the occurrence of a valid conversion. In some implementations, digital component distribution system 150 sends client device 110 a redirect to the reporting domain (312). For example, the redirect may include a URL to the reporting system 190 domain. Redirects can also include blind-signed combined conversion data.

In some implementations, redirects have a particular form that can be detected by applications 112 (eg, native applications, browsers, or operating systems that report impressions and conversions). This particular format may include the URL of the reporting domain and metadata containing the blind-signed combined conversion data. Metadata can be specified as a query parameter in the URL of the reporting domain.

Application 112 running on client device 110 receives the redirect and detects the particular form of redirect (314). Applications 112 may treat redirects with a particular format as special requests to generate measurement data elements for reporting conversions.

In response to being notified that a valid conversion has occurred, for example, upon detecting that the redirect has a particular form, application 112 verifies the signature of the blind-signed combined conversion data (316). . For example, if the VOPRF protocol was used to blind-sign a combination of signed impression data and conversion data, the VOPRF protocol can be used to verify the signature of the blind-signed conversion data. Application 112 may similarly unblind conversion data (318). For example, application 112 may use the VOPRF protocol to unblind conversion data. Application 112 may then record unblinded conversion data (320), for example, by storing the conversion data as a conversion record on client device 110 . Application 112 may also store the blind-signed combined conversion data in the conversion record.

In some implementations, rather than generating a measurement data element to report a conversion and transmit the measurement data element upon detection of a conversion, the application 112 adds a random delay before sending the measurement data element. It may add and/or transmit measurement data elements in batches. This prevents time-based attacks and further protects user privacy. For example, delaying a report prevents an entity from intercepting the report and associating it with a conversion event that is known to have just occurred.

FIG. 4 is a flow diagram illustrating an exemplary process 400 for generating measurement data elements and providing measurement data elements to an aggregation system. Process 400 may be implemented, for example, by client device 110 and aggregation system 180 interacting with fraud detection system 170 and digital component distribution system 150 . The operations of process 400 may also be implemented as instructions stored on a non-transitory computer-readable medium such that execution of the instructions by one or more data processing devices causes process 400 to occur in one or more data processing devices. can be executed.

The client device 110 obtains a conversion record (402). As noted above, a conversion record may include blind-signed combined conversion data for detected conversions. The application 112 running on the client device 110 responds, for example, to a determination that a randomly selected delay for reporting conversions has expired, or to a decision to send a batch of conversion data. to get conversion records.

The client device 110 encrypts (404) at least a portion of the conversion record. For example, application 112 may encrypt blind-signed combined conversion data. In some implementations, the application 112 uses threshold encryption, e.g., a (t, n)-threshold encryption scheme, to store the blind-signed combined conversion data. Encrypt. By using threshold encryption, the recipient does not receive at least t measurement data elements for the same impression-conversion pair, e.g., from at least t applications (e.g., web browsers or native applications or devices) As long as the encrypted data cannot be decrypted.

In some threshold encryption techniques, the dealer provides each player, which in this example is each instance of application 112, with a shared secret or key. Rather than providing each application 112 on each client device 110 with a shared secret, each instance of application 112 is configured to generate a group key that encrypts data. In order for each application 112 to generate the same group key, each application 112 can use the same seed to generate the group key. This seed may be impression data and/or conversion data or may be based on impression data and/or conversion data. The combined, blind-signed conversion data for a given impression-conversion pair must be signed by the same entity (e.g., fraud detection system 170 and digital component delivery system 150) to each instance of the application using the same protocol and secret key. are the same, and each instance of application 112 blind-signs the data using the same protocol.

In one example, the seed may be blind-signed combined conversion data or a combination of blind-signed combined conversion data and additional data such as a reporting URL or reporting system 190 . In another example, the seed may be generated by encrypting the blind-signed combined conversion data using the reporting system's 190 public key so that even after the group key is regenerated, the reporting system's 190 Only system 190 can decode impression and conversion data. For example, the seed may be a combination of the encrypted blind-signed combined conversion data and the reporting system's 190 reporting URL encrypted using the reporting system's 190 public key.

Different types of (t, n) threshold encryption schemes can be used to encrypt impression and conversion data. For example, use a polynomial or plane (t, n)-threshold to distribute secret shares (e.g., impression and conversion data) and recover secrets when at least t shares are received. Value encryption schemes can be used. In a particular example, the threshold encryption scheme may be a plane-based encryption scheme in which the group key comprises planes and the measured data is at the intersection of each plane, eg, Blakley's scheme. In other examples, the threshold encryption scheme may use the Chinese remainder theorem, proactive secret sharing, verifiable secret sharing (VSS), or other suitable threshold encryption techniques.

In an exemplary polynomial approach, when application 112 accesses the conversion report, application 112 can use the above seed to generate group identifiers (eg, tags) and seed values. For example, application 112 can use a first key derivation function (eg, a one-way cryptographic hash function) and a seed to generate a group identifier. This group identifier can be a random number that uniquely identifies a pair of impressions and conversions. Since each application 112 reporting this impression-conversion pair uses the same key derivation function and the same seed, the group identifier will be the same for each application 112 reporting the impression-conversion pair. Group identifiers are used to aggregate data and determine the amount of conversions, as described below.

Application 112 may use a second key derivation function (eg, a one-way cryptographic hash function) and a seed to generate an initial value for the pseudorandom number generator. Application 112 can then use the initialized pseudo-random number generator to generate the coefficients of the polynomial function of order t-1. In this example, a polynomial function serves as the group key. The polynomial function can be of the form A ₀ +A ₁ X ¹ +A ₂ X ² +, …A _t X ^t , where t is the minimum value, e.g. the threshold, the number of groups required to decode the data The number of member keys, X ⁱ , is the result of raising X to the I power, and A _i is the generated modulus.

Each instance of application 112 can be configured to select a particular point on the secret's polynomial function. For example, each instance of application 112 can be configured to select a different point on the secret's polynomial function. In our particular example, this point is at X=0 and the secret is the Y value at X=0, the value of A ₀ . Other points can also be used. In one implementation, the application 112 selects a random nonce at the time of the impression and asks the fraud detection system 170 to either blind sign or sign the nonce for public verifiability using public key signatures. , and then the signed nonce can be used as the point's X value. Aggregation system 180 ignores all points whose X values are not properly signed by fraud detection system 170 .

Application 112 may select a point on the polynomial function as a shared secret to report to aggregation system 180 . This sharing of secrets is the group membership key. To allow each instance of application 112 to choose a different point to be able to determine the secret from the t group member keys, each instance of application 112 is either an instance of application 112 or an instance of application 112 is running The point may be configured to select using data associated with the client device 110 being viewed. For example, application 112 may use a unique application identifier that uniquely identifies an instance of application 112 or a unique device identifier that uniquely identifies client device 110 to select that point on the polynomial function. In a particular example, application 112 uses a third key derivation function (e.g., a one-way cryptographic hash function), a unique application identifier or unique device identifier, and a seed to select points on the polynomial function. can do. Optionally, the application 112, when verifying that an impression and/or conversion is genuine, will sign the X coordinate of the selected point (on behalf of the digital component provider where the conversion is made) to the fraud detection system 170 or A digital component distribution system can be requested and then choose the signed X coordinate as the X coordinate to compute the secret share.

The client device 110 generates measurement data elements and transmits the measurement data elements to the aggregation system (406). In some implementations, measurement data elements include group member keys (eg, coordinates of points on the polynomial selected by application 112) and group identifiers (eg, tags). For example, a group identifier and a group member key can represent key/value pairs.

Aggregation system 180 receives the measurement data elements and updates the measurement data element database (408). For example, aggregation system 180 may store each received measurement data element in a database or another data structure or data storage device. Aggregation system 180 may also update the number of group member keys received for the group identifier.

Aggregation system 180 determines whether sufficient data has been received to decrypt the encrypted text (410). As noted above, it is necessary to receive at least t individual group member keys in order to regenerate the group key and decrypt impression and conversion data. Aggregation system 180 may compare the number of group member keys for a group identifier with a threshold t.

If less than t measurement data elements with a group identifier have been received, aggregation system 180 can continue to wait for additional measurement data elements with the same group identifier. Aggregation system 180 loads a group member key if at least t measurement data elements with the same group identifier are received (412).

Aggregation system 180 may then decrypt the secret (414). As noted above, the secret can be the blind-signed combined conversion data, the combination of the blind-signed combined conversion data and additional data (e.g., the reporting system 190 reporting URL), or the encrypted blind It can be a signed combined conversion data combination (using the reporting system's public key) and the reporting URL of the reporting system 190 . To decrypt the secret, aggregation system 180 can use the group member key to regenerate the group key or representation of the group key. For example, if a polynomial function technique is used to encrypt the secret, aggregation system 180 uses the points defined by the group member keys of at least t measured data elements with group identifiers to calculate the polynomial function. Can be regenerated. Aggregation system 190 can interpolate between these points to regenerate the polynomial function. Aggregation system 190 can then identify specific points whose values are secret.

Aggregation system 180 reports the conversions to reporting system 190 (416). Aggregation system 180 may generate and send data to reporting systems, including impression and conversion data (which may still be encrypted) and conversion numbers. Aggregation system 180 can determine the number of distinct group member keys received in the measurement data element containing the group identifier corresponding to the impression-conversion pair as the number of conversions. That is, the number of conversions is the number of distinct measurement data elements containing group identifiers.

The impression data and conversion data in the reported data can be blind signed combined conversion data or this data encrypted using the reporting system 190 public key. For example, as described above, the secret can be the combination of the blind-signed combined conversion data and the reporting URL of reporting system 190 . After obtaining the secret, the aggregation system 180 can access the reporting URL and send the rest of the information in the secret to the reporting system 190 along with the amount of conversions.

Reporting system 190 uses the private key corresponding to the public key used to generate the encrypted reporting data to generate the encrypted blind-signed combined conversion data (encrypted case) is decrypted (418). Reporting system 190 may optionally verify signatures associated with impression data and conversion data. In some implementations employing VOPRF for blind signing, signature verification requires reporting system 190 to contact fraud detection system 170 that previously blind signed impression data.

The reporting system 190 verifies the signature of the impression data generated by the fraud detection system (420). For example, reporting system 190 may send blind-signed combined conversion data to fraud detection system 170 along with a request to verify the blind signature of the blinded impression data generated by fraud detection system 170. . Fraud detection system 170 may attempt to verify the signature and respond to reporting system 190 with data specifying whether the signature is valid.

Similarly, the reporting system 190 can verify the signature of the combination of blinded impression data and conversion data (422). For example, the reporting system may send the combined blind-signed conversion data to the digital component distribution system along with a request to verify the blind signature of the combination of the blinded impression data and the conversion data generated by the digital component distribution system 150 . 150 can be sent. Digital component distribution system 150 may attempt to verify the signature and respond to reporting system 190 with data specifying whether the signature is valid.

If both signatures are valid, the reporting system can store data specifying the number of conversions for the impression-conversion pair (424). Reporting system 190 provides digital component provider 160 with each impression of a digital component issued by digital component provider 160 after a sufficient number (eg, at least t) of conversions has occurred to enable encryption. You can provide data specifying the number of conversions for a conversion pair.

After receiving at least t measurement data elements for a given impression-conversion pair, aggregation system 180 uses data from previously received measurement data elements and, in a similar manner, aggregates the received impressions Any additional measurement data element can be decoded, including group identifiers for pairs of conversions and conversions. In this way, the aggregation system 180 can keep the conversion counts of impression-conversion pairs updated.

In some implementations, a conversion number is determined for each of multiple dimensions. Dimensions can be different dates or date ranges, different locations, and so on. For example, the digital component provider 160 may want to know the number of digital component conversions for each month of the year. The secret in the (t,n)-encryption scheme can be based on the dimension value of the conversion to set a separate measure for each dimension. For example, if a polynomial technique is used, both the seed and the tag (eg, group identifier) can be any of the seed/tags above combined with the dimension value. In a particular example, a seed may be a combination of blind-signed combined conversion data and dimension values optionally converted by a cryptographic hash or encryption function. In this way, the application generates a different polynomial function and a different group identifier for each dimension value.

The number of conversions can also be determined for combinations of dimensions. In this example, the seed can be any of the above seeds combined with each dimension value. In a particular example, the seed may be a combination of the blind-signed combined conversion data and the value of each dimension.

The above techniques can be further adapted to prevent Sybil attacks, for example, if the application 112 is compromised after computing the plaintext value of the combined conversion data. If it is compromised, the application 112 can share the plaintext value with any number of other applications 112, all of which can report the same plaintext value to the same aggregation system 180, This defeats the k-anonymity protection of the (t, n)-threshold encryption scheme. To prevent Sybil attacks, uniqueness of legitimate impressions/conversions can be supported using the process shown in Figure 5.

FIG. 5 is a flow diagram illustrating another exemplary process 500 for reporting conversion data. Process 500 may be implemented by a client device, such as client device 110 in FIG. 1, for example. The operations of process 500 may also be implemented as instructions stored on a non-transitory computer-readable medium such that execution of the instructions by one or more data processing devices causes process 500 to occur in one or more data processing devices. can be executed.

Blind-signed impression data is obtained (502). As noted above, when a digital component is presented with content, such as a web page or application content, the application presenting the content can store impression data for impressions of the digital component. Impression Data for a particular presentation of a Digital Component may include the URL or domain of the Digital Component's landing page (e.g., the page linked by the Digital Component), one or more identifiers for the Digital Component, and the event-level data associated with the impression. Data, an expiration date that specifies when impression data is removed from the client device, and/or a reporting URL or domain to which conversion reports for digital components are sent.

The impression data can be blinded and sent along with the fraud detection signal to another device or system, such as the fraud detection system 170 of FIG. In this example, rather than blinding the impression data itself, application 112 uses a public key fetched from a reporting system, for example, reporting system 190 in FIG. For example, whether the user clicked or otherwise interacted with the digital component) combination can be encrypted. Application 112 then blinds the encryption result and sends the blind encryption result to fraud detection system 170 for blind signing. The fraud detection system 170 can determine whether the impression is valid based on the fraud detection signal, and if valid, the first impression blind signing key secretly maintained by the fraud detection system 170. Blind-sign the blinded impression data using Fraud detection system 170 may return blind-signed impression data to client device 110 .

Blind-signed impression data and nonce data are obtained (504). Application 112 running on client device 110 can randomly create a nonce with sufficient entropy, eg, 32 bytes of random numbers. Client device 110 may then use the combination of blinded impression data, clicked value, and nonce to generate a hash-based message authentication code (HMAC), e.g., HMAC _SHA256 message code. can. Application 112 may send the impression nonce message code to fraud detection system 170 along with a request to blind sign the impression nonce message code. As noted above, if the impression is valid, the fraud detection server may blind sign the impression nonce message code using a second impression blind signing key that is secretly maintained by the fraud detection system 170. can. The second impression blind signing key of the fraud detection system 170 is different from the first blind signing key of the fraud detection system 170 in that it cannot obtain the signature of the impression and claims that it is a nonce signature. and vice versa. Fraud detection system 170 may return a blind signed impression nonce message code to client device 110 .

Blind signed combined conversion data is obtained (506). When a conversion occurs, the system that determined that the conversion occurred, eg, digital component distribution system 150 of FIG. 1, can provide the conversion data to application 112 . Application 112 may generate blinded conversion and impression data by encrypting a combination of conversion data and HMAC code, eg, the impression data's HMAC _SHA256 message code. For example, the client device can combine this impression message code with the conversion data and encrypt the combination using the public key fetched from reporting system 190 of FIG.

Application 112 can then send the blind-signed impression data and the blinded conversion and impression data to digital component distribution system 150 along with a request to blind-sign this combination of data. The digital component distribution system 150 may blind sign the blind signed impression data and the combination of the blind conversion data and the impression data using the first conversion blind signing key of the digital component distribution system 150. can. This blind signed data is the combined blind signed conversion data in this example.

Blind-signed conversion data and nonce data are obtained (508). This nonce may be the same nonce used to obtain blind-signed impression data and nonce data. Application 112 may use the combination of blinded conversion data and nonce to generate an HMAC, eg, HMAC _SHA256 message code. Client device 110 can send the conversion nonce message code to digital component distribution system 150 along with a request to blind sign the conversion nonce message code. As above, if the conversion is valid, the fraud detection server blind signs the conversion nonce message code using a second conversion blind signing key secretly maintained by the digital component distribution system 150. can be done. Unlike the first conversion blind signature key of the digital component distribution system 150, the second conversion blind signature key of the digital component distribution system 150 cannot obtain a conversion signature, which is a nonce signature. claim. Digital component delivery system 150 may return a blind-signed conversion nonce message code to client device 110 .

A measurement data element is generated (510). In this example, application 112 can generate a measurement data element that includes a group member key (eg, impression data and conversion data) representing secret sharing, a group identifier, and a unique key.

Application 112 may generate a unique key by generating a combined message that includes a blind-signed impression nonce message code, a blind-signed conversion nonce message code, and a nonce. Each part of the combined message can be included in a respective field of the combined message. Application 112 can then generate a unique key by encrypting the combined message using the blind-signed combined conversion data as an encryption key.

Application 112 may generate group member keys using threshold encryption, similar to how group member keys are generated using process 400 of FIG. For example, the group member key can be generated using a polynomial technique, the seed being the combined blind-signed conversion data, the combined blind-signed conversion data and additional data (e.g., reporting system 190 ), or encrypted, blind-signed combined conversion data (using the reporting system's public key) and the reporting URL of the reporting system 190 .

Application 112 may also generate group identifiers, similar to how group identifiers are generated using process 400 of FIG. For example, application 112 can use a key derivation function (eg, a one-way cryptographic hash function) and a seed to generate a group identifier.

Application 112 may send measurement data elements including group member keys, unique keys, and group identifiers (512). For example, application 112 may send measurement data elements to an aggregation system, such as aggregation system 180 in FIG. Applications can send measurement data elements after a randomly selected (or pseudo-random) period of time has elapsed after a conversion is detected to prevent time-based attacks.

FIG. 6 is a flow diagram illustrating an exemplary process 600 for decoding impression data. Process 600 may be implemented by one or more servers, such as aggregation system 180 and/or reporting system 190 of FIG. 1, for example. The operations of process 600 may also be implemented as instructions stored on a non-transitory computer-readable medium such that execution of the instructions by one or more data processing devices causes process 600 to occur in one or more data processing devices. can be executed.

A measurement data element is received from a client device (602). For example, an application 112, e.g., a web browser or native application, running on the client device 110 may generate and transmit measurement elements in response to detected impressions and conversions (e.g., impression-conversion pairs). can be done. In some implementations, the measurement data element can include a group member key and a group identifier, as described above with reference to FIG. In some implementations, the measurement data elements can include group member keys, group identifiers, and unique keys, as described above with reference to FIG. In either implementation, the group member key can be generated using a (t,n)-threshold encryption technique using a seed based on impression data of impressions and a threshold t.

A determination is made whether at least t measurement data elements have been received for the impression and conversion pair (604). For example, the number of distinct measurement data elements received and containing group identifiers for impression-conversion pairs may be counted. This count can be compared to a threshold t.

If less than a threshold t distinct measurement data elements for an impression-conversion pair are received, the process 600 determines that the secret (e.g., impression data and conversion data) is a set of at least t measurements for an impression-conversion pair. Since the data elements cannot be decoded until received, operation 602 can be returned to await additional measurement data elements of the impression-conversion pair.

The encrypted impression data for each measurement data element is decrypted (606) if at least a threshold t individual measurement data elements of the impression-conversion pair are received. In implementations where the measurement data element includes the group member key and group identifier, the encrypted impression data can be decrypted as described above with reference to FIG.

In implementations where the measurement data element includes a group member key, a group identifier, and a unique key, as described above with reference to Figure 4, the combined blind-signed conversion data and reporting URL will contain the group key can be recovered by regenerating the Recovered conversion data and recovered impression data can be unblinded using the protocol used to blind the data.

The combined message containing the blind-signed impression nonce message code, the blind-signed conversion nonce message code, and the nonce is processed by decrypting the unique key using the blind-signed combined conversion data can recover. The blind signed impression nonce message code and blind signed conversion nonce message code can then be verified using the blind signed impression data, the blind signed conversion and impression data, and the nonce. For example, the aggregation system 180 may use the recovered impression data and the nonce to compute a blind-signed impression nonce message code (e.g., HMAC _SHA256 message code), which may be converted to a recovered blind-signed impression nonce message. Code can be compared. Similarly, aggregation system 180 uses the recovered impression and conversion data and the nonce to compute a blind signed conversion nonce message code (e.g., HMAC _SHA256 message code), which is converted to the recovered blind It can be compared with the signed conversion nonce message code. If both match, both recovered codes are verified.

The fraud detection system 170 can then verify the blind signatures on the impression data and the blind signatures on the impression data and the nonce data. Similarly, digital component distribution system 150 can verify blind signatures on blind-signed conversion data and blind signatures on blind-signed conversion and nonce data.

Then, to ensure k-anonymity, the number of unique nonces in the impression-conversion pair measurement data element can be determined. Then, to ensure k-anonymity, the number of unique nonces in the impression-conversion pair measurement data element can be determined. The number of unique nonce is the number of browsers (or applications) reporting impression/conversion events. If the number of unique nonce is greater than k, the reporting system knows that at least k browsers have seen the event and reports the number of conversions to the digital component delivery system. If the number of unique nonces is less than k, the reporting system will not report the number of conversions, hence k-anonymity is applied. A compromised browser cannot forge additional nonce in a way that circumvents the above validation.

If all the above validations are successful, the impression and conversion are valid and not part of a Sybil attack. In response to determining that each of the verifications was successful, the blind signed impression data, the blind signed conversion data and the impression data, and the number of unique nonce are sent to the reporting system 190 using the reporting URL. can do. Reporting system 190 can then recover the impression data using the private key corresponding to the public key used to encrypt the impression data. The reporting system 190 similarly encrypts the conversion data by decrypting the blind-signed conversion and impression data using the private key used to encrypt the blind conversion and impression data. can recover.

FIG. 7 is a block diagram of an exemplary computer system 700 that can be used to perform the operations described above. System 700 includes processor 710 , memory 720 , storage device 730 and input/output devices 740 . Each of components 710, 720, 730, and 740 may be interconnected using system bus 750, for example. Processor 710 can process instructions for execution within system 700 . In some implementations, processor 710 is a single-threaded processor. In another implementation, processor 710 is a multithreaded processor. Processor 710 can process instructions stored in memory 720 or storage device 730 .

Memory 720 stores information within system 700 . In one implementation, memory 720 is a computer-readable medium. In some implementations, memory 720 is a volatile memory unit. In another implementation, memory 720 is a non-volatile memory unit.

Storage device 730 can provide mass storage for system 700 . In some implementations, storage device 730 is a computer-readable medium. In various different implementations, storage device 730 may be, for example, a hard disk device, an optical disk device, a storage device shared over a network by multiple computing devices (eg, a cloud storage device device), or some other mass storage device. can include devices.

Input/output devices 740 provide input/output operations for system 700 . In some implementations, input/output device 740 is one or more network interface devices such as Ethernet cards, serial communication devices such as RS-232 ports, and/or wireless interface devices such as 802.11 cards. can include In another implementation, the input/output devices may include driver devices configured to receive input data and send output data to external devices 760, such as keyboards, printers, and display devices. However, other implementations can also be used, such as mobile computing devices, mobile communications devices, set-top box television client devices, and the like.

Although an exemplary processing system is described in FIG. 7, implementations of the subject matter and functional operations described herein may be implemented in other types of digital electronic circuits, or in computer software, firmware, or hardware. including the structures disclosed herein and their structural equivalents, or combinations of one or more thereof.

Embodiments of the subject matter and operations described herein may be implemented in or in digital electronic circuitry, or computer software, firmware, or hardware including the structures disclosed herein and their structural equivalents. can be implemented in one or more combinations. Embodiments of the subject matter described herein may be stored on a computer storage medium (or media) for execution by or for controlling the operation of one or more computer programs, i.e., data processing apparatus. It can be implemented as one or more modules of encoded computer program instructions. Alternatively, or additionally, the program instructions may be an artificially generated propagated signal, e.g. It can be encoded into the generated electrical, optical, or electromagnetic signal. A computer storage medium may be or be included in a computer readable storage device, a computer readable storage substrate, a random or serial access memory array or device, or a combination of one or more thereof. Moreover, although a computer storage medium is not a propagated signal, a computer storage medium can be a source or destination of computer program instructions encoded in an artificially generated propagated signal. A computer storage medium may also be or be contained within one or more separate physical components or media (eg, multiple CDs, discs, or other storage devices).

The operations described herein may be implemented as operations performed by a data processing apparatus on data stored in one or more computer readable storage devices or received from other sources. can be done.

The term "data processor" means any kind of apparatus, device and machine for processing data including, for example, a programmable processor, computer, system on a chip, or any number or combination of the foregoing. encompasses The device may include dedicated logic circuits such as FPGAs (Field Programmable Gate Arrays) or ASICs (Application Specific Integrated Circuits). The apparatus also includes, in addition to hardware, code that creates an execution environment for the computer program in question, such as processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or one of these. Or it can contain codes that make up multiple combinations. Devices and execution environments can implement a variety of different computing model infrastructures, such as web services, distributed computing, and grid computing infrastructures.

A computer program (also known as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted, declarative, or procedural languages. , can be deployed in any form, such as as a stand-alone program, or as modules, components, subroutines, objects, or other units suitable for use in a computing environment. A computer program may, but need not, correspond to files in a file system. A program may be part of a file holding other programs or data (e.g., one or more scripts stored in a markup language document), a single file dedicated to the program in question, or multiple (eg, files that store one or more modules, subprograms, or portions of code). A computer program can be deployed to be executed on one computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communications network.

The processes and logic flows described herein are performed by one or more programmable processors executing one or more computer programs to perform actions by manipulating input data and generating output. can do. The processes and logic flows may also be performed by dedicated logic circuits, such as FPGAs (Field Programmable Gate Arrays) or ASICs (Application Specific Integrated Circuits), and devices may be implemented as such.

Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors. Generally, a processor receives instructions and data from read-only memory and/or random-access memory. The essential elements of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Generally, a computer also includes, receives data from, or transfers data to, one or more mass storage devices for storing data, such as magnetic, magneto-optical, or optical disks. or operably coupled to both. However, the computer does not require such a device. In addition, the computer may be connected to another device such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a handheld device, just to name a few. It can be embedded in a storage device (eg, Universal Serial Bus (USB) flash drive). Devices suitable for storing computer program instructions and data include, by way of example, semiconductor memory devices such as EPROM, EEPROM and flash memory devices, magnetic disks such as internal or removable disks, magneto-optical disks, and CDROMs. and all forms of non-volatile memory, media, and memory devices, including DVD-ROM discs. The processor and memory may also be supplemented by, or incorporated in, dedicated logic circuitry.

To provide interaction with a user, embodiments of the subject matter described herein include a display device, such as a CRT (cathode ray tube) or LDC (liquid crystal display) monitor, for displaying information to a user; It can be implemented on a computer having a keyboard and pointing device, such as a mouse or trackball that allows a user to provide input to the computer. Other types of devices can be used to provide user interaction. For example, the feedback provided to the user can be any form of sensory feedback, e.g., visual, auditory, or tactile feedback, and the input from the user can be acoustic, speech, or tactile input. can be received in any format, including Additionally, the computer may be used by sending and receiving documents to and from the device used by the user, e.g., by sending web pages to the web browser on the user's client device in response to requests received from the web browser. , can interact with the user.

Embodiments of the subject matter described herein may include backend components, such as data servers, or middleware components, such as application servers, or may include, for example, user A computing system that includes a front-end component, such as a client computer having a graphical user interface or web browser capable of interacting with a subject implementation, or one or more such back-end components, middleware components, or front-end components It can be implemented in any combination of end components. The components of the system can be interconnected by any form or medium of digital data communication such as a communication network. Examples of communication networks include local area networks (“LAN”) and wide area networks (“WAN”), internetworks (eg, the Internet), and peer-to-peer networks (eg, ad-hoc peer-to-peer networks).

The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. In some embodiments, the server sends data (eg, HTML pages) to the client device (eg, for the purpose of displaying the data to and receiving user input from users interacting with the client device). . Data generated at the client device (eg, results of user actions) can be received from the client device at the server.

Although this specification contains many specific implementation details, these should not be construed as limitations on the scope of the invention or what may be claimed, but rather of features inherent in the particular embodiment of the particular invention. should be interpreted as an explanation. Certain features that are described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Further, even if features are described above as working in a particular combination and are originally claimed as such, one or more features from the claimed combination may in some cases be cut out of the combination. A claimed combination may be directed to a subcombination or variations of a subcombination.

Similarly, although operations have been drawn in the figures in a particular order, this does not mean that such operations are performed in the specific order or order shown, or that they are illustrated in order to achieve a desired result. should not be construed as requiring that all actions be performed. Multitasking and parallelism can be advantageous in certain situations. Furthermore, the separation of various system components in the above embodiments should not be understood as requiring such separation in all embodiments, and the program components and systems described generally operate in a single unit. can be integrated together into multiple software products or packaged into multiple software products.

Accordingly, specific embodiments of the subject matter have been described. Other embodiments are within the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve desirable results. Moreover, the processes illustrated in the accompanying drawings do not necessarily require the particular order or order illustrated to achieve desirable results. Multitasking and parallelism may be advantageous in certain implementations.

100 environment
105 Data Communication Network
110 client devices
112 applications
114 Impression data
116 conversion data
130 Publishers
140 websites
145 Resources
150 Digital Component Distribution System
157 Digital Component Partners
160 Digital Component Provider
170 Fraud detection system
180 aggregation system
190 Reporting system
200 processes
300 processes
400 processes
500 processes
600 processes
700 computer system
710 processor
720 memory
730 storage devices
740 input/output devices
750 system bus
760 external devices

Claims (13)

receiving from each of a plurality of client devices a measurement data element comprising a respective group member key and a group identifier for a given conversion as a result of displaying a digital component, said step being performed at each client device; The application
generating, based at least on network data including one or more of impression data or conversion data for said conversion, a group key defining a secret for encrypting said network data, wherein each group member key; comprises a respective share of said secret;
generating said respective group member key based on data associated with said application, wherein each client device generates a different group member key comprising a different sharing of said secret; , using a threshold encryption scheme, and
determining that at least a threshold number of measurement data elements with the group identifier have been received;
responsive to determining that at least the threshold number of measurement data elements having the same group identifier have been received, decrypting the network data using the group member key in the received measurement data elements; A computer-implemented method comprising: each application generating and transmitting said measurement data elements in response to the occurrence of conversions associated with said impression data; 2. The method of claim 1, further comprising determining a number. 3. The method of any one of claims 1 or 2, wherein generating the group key comprises generating the group key based on blind signed impression data. The blind-signed impression data is
Blinded impression data signed by a first system that determined said impression to be valid and a second system that determined to register said conversion, by blinding said impression data the generated blinded impression data;
4. The method of claim 3, comprising blind signed combined conversion data comprising conversion data signed by the second system. The step of generating the group key uses a combination of the blind-signed combined conversion data and a network address of a reporting system to which the conversion data of the digital component is reported to generate the group key. 5. The method of claim 4, comprising steps. 6. The method of claim 5, wherein the blind-signed combined conversion data is encrypted using the reporting system's public key. 7. A method according to any preceding claim, wherein said data relating to said application comprises a unique identifier for said application. wherein the threshold encryption scheme comprises a polynomial-based threshold encryption scheme, the application running on each client device comprising:
generating a polynomial function as the group key based on a seed comprising at least the impression data;
selecting the same point on the polynomial function to have a value corresponding to the secret;
and selecting a second point on the polynomial function that is different from the same point, using the data associated with the application as the respective group member key. The method according to item 1. decrypting the impression data using the group member key in the received measurement data element;
regenerating the polynomial function using the second points;
and identifying the same points on the regenerated polynomial function. 10. The method of any one of claims 1-9, wherein the threshold encryption scheme comprises any of a Chinese Remainder Theorem-based scheme, proactive secret sharing, or verifiable secret sharing. One or more computer-readable storage media comprising instructions that, when executed by a computer, cause the computer to perform the steps of the method of any one of claims 1-10. A computer program product comprising instructions which, when executed by a computer, cause said computer to perform the steps of the method according to any one of claims 1 to 10. 12. A system for preventing fraud, comprising a data processing system having one or more processors according to claim 11 and one or more computer-readable storage media, wherein the one or more processors: A system configured to perform the steps of any one of claims 1-10.

Images